B1 and B2: separating the SOCI regulatory regime

Bill One: Clear and Present Danger

In recommending to split the Original Bill, the PJCIS focused primarily on evidence of an increasing cyber-threat environment. The PJCIS cited the Department of Home Affairs Secretary Michael Pezzullo’s submission as informing the recommendation to carve out these Government Assistance powers into a separate bill:³

‘...it allows us to activate certain emergency procedures under the government assistance measures, and it is those measures that, frankly, I would prefer to have on the statute books tonight.’

In recommending the carve out approach, the PJCIS included the expanded definitions of Critical Infrastructure Assets and Critical Infrastructure Sectors, as well as the obligation on responsible entities to notify the Government of critical incidents.⁴ These amendments remain highly relevant to companies in the applicable sectors as the government’s assistance powers were concerning to many, both in regard to their reach and application. However, in prioritising the creation of the government’s intervention powers, the PJCIS was evidently convinced that the threat was real and present.

Bill Two: Back to the Future

The PJCIS recommended that the remainder of the Original Bill be ‘revisited and reconsidered’ by the Department in a separate bill, known as “Bill Two”.⁵  This approach recognises the deep ‘reservation’ and concern from industry and other stakeholders about the wide-ranging scope and the ‘unknown or unquantifiable’ cost of compliance with the other elements of the Original Bill, including the risk management programs and declaration of systems of national security (and associated enhanced cyber security obligations). Indeed, the PJCIS noted that most, if not all, contributors to the review expressed reservations and concluded that, as currently formulated, the framework was not ready to be progressed at this time.⁶

In particular, the PJCIS cited several factors including:

• the over-reliance on delegated legislation to implement the sector-specific rules;
• the unclear burden of compliance potential to be ‘overwhelmed by red tape’;
• the need for industry ‘buy in’; and
• the potential impact on foreign investment and FIRB processes.⁷

Conclusion

By recommending the separation of the Original Bill, the PJCIS appears to acknowledge the threat environment and provides a pathway for the Government to obtain the emergency intervention powers it wanted without the more controversial elements that may have resulted in Parliamentary deadlock. Sacrificing the more compliance-focused elements of the SOCI reforms in the immediate future is an effective trade-off for the government, especially where alternative regulatory avenues may be available to drive cyber-security uplift.⁸

And while this may have removed potential compliance burdens on industry for the time-being, the potential for direct Government intervention in respect of critical infrastructure, and the over-arching risk of cyber-threat itself, remains.

Table 1: Recommended Split Response

Source: Advisory Report

Please see our previous update which provides a broader overview of the SOCI reforms. We continue to monitor and publish further updates. If you have any queries in respect of how the proposed legislation may impact your operations, or how we may be able to assist with your engagement with any consultation processes, please get in touch.